prisma-risk / tsoracle / 26376896994

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(consensus): reject out-of-range high-water advance before persisting (#360)

An out-of-range physical_ms value (> PHYSICAL_MS_MAX) handed to
persist_high_water was durably committed by both consensus backends
before any range check: the openraft and paxos drivers appended the
Advance to the replicated log and applied it with an unchecked
max(prev, at_least). Only the single-node FileDriver guarded at persist
time.

A committed out-of-range value is a poison. On every subsequent
leadership gain load_high_water returns it, the allocator's
try_on_leadership_gained rejects it (PhysicalMsOutOfRange), and the new
leader can never serve; the high-water only ratchets up, so it cannot
self-heal. The most plausible trigger is a saturated clock, since
SystemClock::now_ms saturates to u64::MAX to surface a far-future clock
visibly.

Centralize the bound in tsoracle-consensus as reject_out_of_range_advance
(classified PermanentDriver) and call it at the propose boundary of every
ConsensusDriver::persist_high_water (openraft, paxos) so the value is
rejected before it is appended and never reaches the apply path. Migrate
FileDriver's inline persist-time check onto the same helper so the bound
cannot drift across backends.

Closes #353

Coverage Stats

67 of 80 new or added lines in 3 files covered. (83.75%)

1 existing line in 1 file now uncovered.

11585 of 12218 relevant lines covered (94.82%)

416240.79 hits per line